CVE-2026-87894 in Rox Appointment Booking Plugin
Zusammenfassung
von MITRE • 12.09.2026
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.